SSHFP check
Compares the SSHFP records a host publishes in DNS against the host keys it is actually presenting. If it publishes none, you get the records to add.
Why this check exists
SSHFP is the one mechanism that closes SSH's trust-on-first-use gap: publish
your host key fingerprints in DNS and a client can verify a machine it has
never seen, instead of typing yes and hoping.
The failure it catches is silent. A host gets rebuilt, its keys change, and
the DNS records keep pointing at keys that no longer exist. A client using
VerifyHostKeyDNS then cannot verify a perfectly healthy host —
and because the fallback is the ordinary first-connect prompt, nobody
notices. The protection looks deployed and has quietly stopped
protecting.
Two honest caveats. This lookup is not DNSSEC-validated and cannot be from here, so unsigned records are only as trustworthy as the path to the resolver. And behind a round-robin name, records that do not match probably belong to sibling machines this check never spoke to — so it says so rather than calling them stale.
From a terminal:
ssh ssh.rocks sshfp codeberg.org curl ssh.rocks/sshfp/codeberg.org